Is it safer or more dangerous to run Windows Update when abroad and using a WPA2 connection to a random cafe's wi-fi?

Obviously good news: you get the latest security tweaks.

Possible bad news: just how likely is it that you've opened up path for malware to get into the heart of the machine?


In this document explaining Windows Update from 2008 (a bit outdated, but you get the idea), it is stated in the Security Protections section that:

  1. Windows Update uses the Secure Socket Layer (SSL) protocol to send and receive information. SSL is used to encrypt the information being transferred, prevents hackers from tampering with information being transferred, and verifies that the Windows Update agent is transferring data from an authorized Microsoft server.
  2. Each update is individually signed using the Secure Hashing Algorithm (SHA-1). This technology allows Windows Update to confirm that the update has been downloaded correctly and hasn’t been changed by anyone. The update signature is also compared to information in the update metadata that was previously downloaded.
  3. Windows Update also checks for the certificate associated with each update. This certificate provides a means for Windows Update to validate the source of each update. Currently Windows Update will only install updates that have certificates issued by Microsoft or other providers that are trusted by Microsoft.

Therefore, you should not be worried about downloading Windows Update on a public Wi-Fi unless the security provided by Windows itself is broken.

  • 1
    Although SHA-1 is being deprecated... – Deer Hunter Sep 18 '14 at 16:53
  • 7
    @DeerHunter Deprecated, but not broken. – Xander Sep 18 '14 at 16:56
  • 5
    @DeerHunter In this case the collision weakness of SHA-1 (which made it deprecated for certs) doesn't matter, as the updates only come from microsoft. – user10008 Sep 18 '14 at 17:07
  • 2
    It checks the SHA-1 hashs only against the metadata it received earlier over the same channel, so this step doesn't add much security anyway. However, the steps 1 and 3 are additional security layers which are independent from this, and either one alone would be enough to make the update secure, even when over a completely untrusted connection. – Philipp Sep 18 '14 at 17:45
  • A DNS based attack on a compromised access point might defeat #1, but #3 would still protect you. Unless they use some sort of certificate pinning, which on second thought is pretty likely. So a DNS attack would probably not affect #1 either. – ntoskrnl Sep 18 '14 at 19:32

Unless the bad guys have the keys used to authenticate updates, you are OK. If the bad guys can break or cajole Microsoft, you are likely already compromised.

The situation gets weird when the bad guys are able to track Microsoft's critical patches, and reverse-engineer them.

There is one attack vector that may be used: blocking access to Windows Update servers while exploiting the remote vulnerability that the updates were supposed to patch.

After they install the rootkit on your machine, the patch may be allowed to proceed. This method relies on high numbers of compromised routers and rather sophisticated attackers who aren't content with password phishing.

To answer your question directly: being abroad does increase the risk, since you are by definition visiting many places where you haven't been before. Hotel chains are known to be compromised.

  • While true, this doesn't answer the question at all. – Xander Sep 18 '14 at 17:24
  • @Xander - kind of fixed. – Deer Hunter Sep 18 '14 at 17:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.